Binance hackers wash 81% of stolen Solana through THORChain

Binance's attackers keep bleeding the loot out the door. Roughly 81% of the stolen Solana has now been moved, with the trail running straight through cross-chain swap protocol THORChain, according to blockchain data platform Arkham. Wallets tied to the hackers still hold 182,443 SOL, worth about $16.9 million — just 18.8% of the 970,522 SOL swiped in the exploit.

Lookonchain mapped the route on Wednesday: the attackers split SOL across multiple wallets, dumped it for USDC, bridged to Ethereum to buy Ether, then flipped that ETH into Bitcoin via THORChain. It's a classic hopscotch pattern designed to break the paper trail.

The hack itself landed Thursday, when attackers compromised employee devices using fake job interviews and malicious software downloads, Binance said. By Tuesday, the exchange said it had replenished 98% of affected tokens and would absorb the losses. On Saturday the FBI pinned the job on North Korea's TraderTraitor group and pushed crypto providers — THORNode operators included — to block transactions tied to the stolen assets. Kim Yo Jong, sister of North Korean leader Kim Jong Un, waved it off as “absurd rhetoric.”

THORChain switched trading back on Wednesday for Bitcoin, Ethereum and several other chains. It had gone dark Saturday after an Ethereum block reorganization exposed a refund bug. According to Chainalysis, that shutdown accidentally threw a speed bump in front of the hackers' laundering run.

The money started spilling onto Solana on Sunday after the attackers drained most of their temporary Tron holding wallets. Chainalysis estimates about $500 million in total value sloshed through Tron, including repeated wallet-to-wallet transfers, while investigator SomaXBT reckons roughly 54% of the crew's more than 47,600 transactions across Tron and Solana were automated.

THORChain has become a favorite rinse cycle for North Korea-linked hacking crews, suspected in the laundering of proceeds from some of the biggest crypto heists, including the $1.4 billion Bybit hack. Meanwhile, Binance's net inflows have turned positive at $2.3 billion as withdrawals expand.